Comments (2)
The answer all depends on how you implement net.Listener
you pass to
Line 68 in a3f0249
net.Conn
you pass to Line 37 in a3f0249
I will give some answers for the general case where you use the tls
package from the Go standard library.
My concern is what happens when an SSL cert expires, or a certificate is changed (because a cert is due to expire shortly), and the client has an active connection to the dRPC server.
Will the client's connection be killed automatically?
The certificate is only validated on handshake. So the connection will keep working. Also certificates are renewed well before they expire, Let's Encrypt certificates are valid for 3 months and renewed after 2 months.
(If you read the TLS spec the server or client can renegotiate at any time but I haven't seen this in the wild.)
Will the client retrieve the new SSL certificate automatically?
The client will validate the certicate against the "parent" certificate in his CA store. These certificates are valid for a multiple years, and are usually updated by your operating system.
I am planning on using Let'sEncrypt autocert to automatically renew certs without requiring a server restart.
In that case you must periodically re-initialize tls.listener
or implement tls.Config.GetCertificate.
Note that Let's Encrypt only works for server certificates. If you want to work with client verification you have to generate the client certificate yourself.
At Storj we developed something called NodeID verification to communicate between the thousands of actors in our network which (I think) does both client and server verifcation through TLS certificates. I'm quite fond of it but it would be overkill for a small project. Implementation is at https://github.com/storj/common/blob/main/peertls/tlsopts/tls.go
Hope this helps!
from drpc.
Thanks so much for your thorough response, this answers all my questions. Awesome job on dRPC and Storj, both products look incredible :-).
from drpc.
Related Issues (20)
- Kubernetes deployment advice HOT 2
- Incorrect JSON deser in HTTP example
- Allow maximum payload size to be configurable HOT 8
- Question: how to do the load balancing? HOT 6
- buffered Writer causes data races with net.Pipe HOT 2
- Support for custom codec? HOT 4
- drpcserver: Find alternative to net.Error.IsTemporary because it's depcrated HOT 1
- Reconnect client to server HOT 3
- Context cancellation closes the connection HOT 16
- migration steps HOT 3
- What is the max message size handling approach? HOT 6
- Tag stable releases HOT 1
- Better example docs
- maximum number of connections HOT 3
- logging addresses HOT 2
- debug logging HOT 2
- Data race during Stream.MsgRecv vs drpcmanager.NewWithOptions HOT 4
- Client load balancing HOT 1
- What does the "D" stand for? HOT 2
- picobuf compatibility with regards to Marshal and Unmarshal.
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from drpc.